Skip to content

RTPProxy CI

RTPProxy CI #603

Workflow file for this run

name: RTPProxy CI
# Controls when the action will run.
on:
# Triggers the workflow on all push or pull request events
push:
pull_request:
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
schedule:
- cron: "0 0 * * *"
# added using https://github.com/step-security/secure-repo
permissions:
contents: read
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
LoadJobs_conf:
name: Load Jobs Settings
uses: ./.github/workflows/.jobs_configure.yml
MinBuild:
name: Lean Build
needs: LoadJobs_conf
if: needs.LoadJobs_conf.outputs.do_MinBuild == 'true'
# The type of runner that the job will run on
runs-on: ubuntu-${{ matrix.os }}
env:
COMPILER: ${{ matrix.compiler }}
TAR_CMD: tar_nosuid
GHA_OS: ubuntu-${{ matrix.os }}
strategy:
matrix:
os: [20.04]
compiler: ['gcc', 'clang', 'gcc-9', 'gcc-10', 'clang-9', 'clang-10']
include:
- os: 22.04
compiler: 'gcc-i386-cross'
- os: 22.04
compiler: 'clang-i386-cross'
- os: 22.04
compiler: 'gcc-mips64-cross'
- os: 22.04
compiler: 'gcc-arm32-cross'
- os: 22.04
compiler: 'gcc-arm64-cross'
- os: 22.04
compiler: 'gcc'
- os: 22.04
compiler: 'clang'
- os: 22.04
compiler: 'gcc-11'
- os: 22.04
compiler: 'gcc-12'
- os: 22.04
compiler: 'clang-11'
- os: 22.04
compiler: 'clang-12'
- os: 22.04
compiler: 'clang-13'
- os: 22.04
compiler: 'clang-14'
- os: 22.04
compiler: 'clang-15'
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Start Docker container
if: endsWith(matrix.compiler, '-cross')
run: sh -x scripts/build/start_container.sh
# - name: Sanitize list of Ubuntu mirrors
# if: endsWith(matrix.compiler, '-cross') == 0
# run: scripts/ft-apt-spy2-check-and-fix.sh
- name: Workaround for tar not being able to access /var/cache/apt/archives
if: endsWith(matrix.compiler, '-cross') == 0
run: |
sudo cp "$(command -v tar)" "$(command -v tar)"_nosuid
sudo chmod u+s "$(command -v tar)"
# Cache the apt-get packages
- name: Cache apt-get packages
if: endsWith(matrix.compiler, '-cross') == 0
uses: actions/cache@v4
with:
path: /var/cache/apt/archives
key: cleanbuild-${{ matrix.os }}-apt-get-${{ github.run_id }}
restore-keys: |
cleanbuild-${{ matrix.os }}-apt-get
cleanbuild-${{ matrix.os }}-${{ matrix.compiler }}-apt-get
- name: Install apt-get updates
run: scripts/ft-apt-get-update.sh
- name: Set up Python
if: endsWith(matrix.compiler, '-cross') == 0
uses: actions/setup-python@v5
with:
python-version: 3.9
- name: install_depends
run: sh -x scripts/build/install_depends.sh
- name: build
run: sh -x ./scripts/do-build.sh cleanbuild
FullBuild:
name: Full Build
needs: [LoadJobs_conf, MinBuild]
if: needs.LoadJobs_conf.outputs.do_FullBuild == 'true'
# The type of runner that the job will run on
runs-on: ubuntu-${{ matrix.os }}
env:
COMPILER: ${{ matrix.compiler }}
TAR_CMD: tar_nosuid
GHA_OS: ubuntu-${{ matrix.os }}
strategy:
matrix:
os: [20.04]
compiler: ['gcc', 'clang', 'gcc-9', 'gcc-10', 'clang-9', 'clang-10']
include:
- os: 22.04
compiler: 'gcc-i386-cross'
- os: 22.04
compiler: 'clang-i386-cross'
- os: 22.04
compiler: 'gcc-mips64-cross'
- os: 22.04
compiler: 'gcc-arm32-cross'
- os: 22.04
compiler: 'gcc-arm64-cross'
- os: 22.04
compiler: 'gcc'
- os: 22.04
compiler: 'clang'
- os: 22.04
compiler: 'gcc-11'
- os: 22.04
compiler: 'gcc-12'
- os: 22.04
compiler: 'clang-11'
- os: 22.04
compiler: 'clang-12'
- os: 22.04
compiler: 'clang-13'
- os: 22.04
compiler: 'clang-14'
- os: 22.04
compiler: 'clang-15'
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Start Docker container
if: endsWith(matrix.compiler, '-cross')
run: sh -x scripts/build/start_container.sh
# - name: Sanitize list of Ubuntu mirrors
# if: endsWith(matrix.compiler, '-cross') == 0
# run: scripts/ft-apt-spy2-check-and-fix.sh
- name: Workaround for tar not being able to access /var/cache/apt/archives
if: endsWith(matrix.compiler, '-cross') == 0
run: |
sudo cp "$(command -v tar)" "$(command -v tar)"_nosuid
sudo chmod u+s "$(command -v tar)"
# Cache the apt-get packages
- name: Cache apt-get packages
if: endsWith(matrix.compiler, '-cross') == 0
uses: actions/cache@v4
with:
path: /var/cache/apt/archives
key: depsbuild-${{ matrix.os }}-apt-get-${{ github.run_id }}
restore-keys: |
depsbuild-${{ matrix.os }}-apt-get
depsbuild-${{ matrix.os }}-${{ matrix.compiler }}-apt-get
- name: Install apt-get updates
run: scripts/ft-apt-get-update.sh
- name: Set up Python
if: endsWith(matrix.compiler, '-cross') == 0
uses: actions/setup-python@v5
with:
python-version: 3.9
- name: install_depends
run: sh -x scripts/build/install_depends.sh
- name: build
run: sh -x ./scripts/do-build.sh depsbuild
FuncTest:
name: Functional Testing
needs: [LoadJobs_conf, FullBuild]
if: needs.LoadJobs_conf.outputs.do_FuncTest == 'true'
# The type of runner that the job will run on
runs-on: ubuntu-${{ matrix.os }}
env:
COMPILER: ${{ matrix.compiler }}
TAR_CMD: tar_nosuid
GHA_OS: ubuntu-${{ matrix.os }}
strategy:
matrix:
os: [20.04]
compiler: ['gcc', 'clang', 'gcc-9', 'gcc-10', 'clang-9', 'clang-10']
include:
- os: 22.04
compiler: 'gcc'
- os: 22.04
compiler: 'clang'
- os: 22.04
compiler: 'gcc-11'
- os: 22.04
compiler: 'gcc-12'
- os: 22.04
compiler: 'clang-11'
- os: 22.04
compiler: 'clang-12'
- os: 22.04
compiler: 'clang-13'
- os: 22.04
compiler: 'clang-14'
- os: 22.04
compiler: 'clang-15'
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Workaround for tar not being able to access /var/cache/apt/archives
run: |
sudo cp "$(command -v tar)" "$(command -v tar)"_nosuid
sudo chmod u+s "$(command -v tar)"
# Cache the apt-get packages
- name: Cache apt-get packages
uses: actions/cache@v4
with:
path: /var/cache/apt/archives
key: functesting-${{ matrix.os }}-apt-get-${{ github.run_id }}
restore-keys: |
functesting-${{ matrix.os }}-apt-get
functesting-${{ matrix.os }}-${{ matrix.compiler }}-apt-get
- name: Install apt-get updates
run: scripts/ft-apt-get-update.sh
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: 3.9
- name: install_depends
run: sh -x scripts/build/install_depends.sh
- name: before_install
run: sh -x scripts/ft-before_install.sh
- name: build
run: sh -x ./scripts/do-build.sh basic
- name: test
run: sh -x scripts/do-test.sh
Glitching:
name: Glitch Injection
needs: [LoadJobs_conf, FuncTest]
if: needs.LoadJobs_conf.outputs.do_Glitch == 'true'
# The type of runner that the job will run on
runs-on: ubuntu-${{ matrix.os }}
env:
COMPILER: ${{ matrix.compiler }}
TAR_CMD: tar_nosuid
GHA_OS: ubuntu-${{ matrix.os }}
strategy:
matrix:
os: [20.04]
compiler: ['gcc', 'clang', 'gcc-9', 'gcc-10', 'clang-9', 'clang-10']
include:
- os: 22.04
compiler: 'gcc'
- os: 22.04
compiler: 'clang'
- os: 22.04
compiler: 'gcc-11'
- os: 22.04
compiler: 'gcc-12'
- os: 22.04
compiler: 'clang-11'
- os: 22.04
compiler: 'clang-12'
- os: 22.04
compiler: 'clang-13'
- os: 22.04
compiler: 'clang-14'
- os: 22.04
compiler: 'clang-15'
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Workaround for tar not being able to access /var/cache/apt/archives
run: |
sudo cp "$(command -v tar)" "$(command -v tar)"_nosuid
sudo chmod u+s "$(command -v tar)"
# Cache the apt-get packages
- name: Cache apt-get packages
uses: actions/cache@v4
with:
path: /var/cache/apt/archives
key: glitching-${{ matrix.os }}-apt-get-${{ github.run_id }}
restore-keys: |
glitching-${{ matrix.os }}-apt-get
glitching-${{ matrix.os }}-${{ matrix.compiler }}-apt-get
- name: Install apt-get updates
run: scripts/ft-apt-get-update.sh
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: 3.9
- name: install_depends
run: sh -x scripts/build/install_depends.sh
- name: before_install
run: sh -x scripts/ft-before_install.sh
- name: build
run: sh -x ./scripts/do-build.sh glitching
- name: test
run: sh -x scripts/do-test.sh
Fuzzing:
name: Fuzz with OSS-Fuzz
needs: [LoadJobs_conf, Glitching]
if: needs.LoadJobs_conf.outputs.do_Fuzzing == 'true'
runs-on: ubuntu-latest
permissions:
security-events: write
strategy:
fail-fast: false
matrix:
sanitizer: [address, undefined, memory, coverage]
steps:
- uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Build Fuzzers (${{ matrix.sanitizer }})
id: build
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
with:
oss-fuzz-project-name: 'rtpproxy'
dry-run: false
language: c
sanitizer: ${{ matrix.sanitizer }}
- name: Run Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
env:
OF_SANITIZER: ${{ matrix.sanitizer }}
with:
oss-fuzz-project-name: 'rtpproxy'
fuzz-seconds: 1200
dry-run: false
parallel-fuzzing: true
language: c
sanitizer: ${{ matrix.sanitizer }}
output-sarif: true
- name: Upload Crash
uses: actions/upload-artifact@v4
if: failure() && steps.build.outcome == 'success'
with:
name: ${{ matrix.sanitizer }}-artifacts
path: ./out/artifacts
- name: Upload Sarif
if: always() && steps.build.outcome == 'success' && matrix.sanitizer != 'coverage'
uses: github/codeql-action/upload-sarif@v2
with:
# Path to SARIF file relative to the root of the repository
sarif_file: cifuzz-sarif/results.sarif
checkout_path: cifuzz-sarif
Docker:
name: Build&Push to DockerHub
needs: [LoadJobs_conf, Fuzzing]
if: needs.LoadJobs_conf.outputs.do_Docker == 'true' &&
(github.event_name == 'push' || github.event_name == 'pull_request')
runs-on: ubuntu-latest
permissions:
packages: write
services:
registry:
image: registry:2
ports:
- 5000:5000
env:
CLANG_VER_NEW: 18
CLANG_VER_OLD: 16
DOCKER_REPO: sippylabs/rtpproxy
GHCR_REPO: ghcr.io/${{ github.repository_owner }}/rtpproxy
LOCAL_REPO: localhost:5000/sippylabs/rtpproxy
BASE_IMAGE: ${{ matrix.base_image }}
CCACHE_ROOT: ccache
DOCKER_RW: ${{ ( github.repository == 'sippy/rtpproxy' && github.event_name != 'pull_request' ) && 'true' || 'false' }}
CCACHE_BIN_IMAGE: ghcr.io/sobomax/ccache:${{ matrix.ccache_bin_image }}
strategy:
matrix:
include:
- base_image: 'debian:12-slim'
ccache_bin_image: 'latest-debian-12'
- base_image: 'ubuntu:latest'
ccache_bin_image: 'latest-ubuntu-24.04'
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: 'recursive'
- name: Set up QEMU
id: qemu
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
with:
driver-opts: network=host
- name: Log in to Docker Hub
if: ${{ env.DOCKER_RW }}
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set dynamic environment
run: |
GIT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
echo "GIT_BRANCH=${GIT_BRANCH}" >> $GITHUB_ENV
OS_TAG="`echo ${BASE_IMAGE} | sed 's|:|_|g'`"
CCACHE_IMAGE="${{ env.GHCR_REPO }}:${GIT_BRANCH}-${OS_TAG}-cccache"
if ! docker pull ${CCACHE_IMAGE} 2>&1 >/dev/null
then
CCACHE_BIMAGE="scratch"
else
CCACHE_BIMAGE="${CCACHE_IMAGE}"
fi
docker pull ${CCACHE_BIN_IMAGE}
echo "CCACHE_IMAGE=${CCACHE_IMAGE}" >> $GITHUB_ENV
echo "CCACHE_BIMAGE=${CCACHE_BIMAGE}" >> $GITHUB_ENV
echo "BUILD_IMAGE=${{ env.LOCAL_REPO }}:latest-${OS_TAG}" >> $GITHUB_ENV
echo "LIBG722_IMAGE=sippylabs/libg722:latest-${OS_TAG}" >> $GITHUB_ENV
PLATFORMS="`docker manifest inspect ${{ env.BASE_IMAGE }} | \
jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture)\(if .platform.variant != null then "/\(.platform.variant)" else "" end)"' | \
sort -u | paste -sd ','`"
echo "PLATFORMS=${PLATFORMS}" >> $GITHUB_ENV
echo "OS_TAG=${OS_TAG}" >> $GITHUB_ENV
if [[ "${{ matrix.base_image }}" == debian:* ]]
then
echo "LIBSSL_APKG=libssl3" >> $GITHUB_ENV
else
echo "LIBSSL_APKG=libssl3t64" >> $GITHUB_ENV
fi
- name: Extract metadata (tags, labels) for Docker
id: meta_dkr
uses: docker/metadata-action@v5
with:
images: ${{ env.DOCKER_REPO }}
tags: |
type=schedule,suffix=-${{ env.OS_TAG}}
type=ref,event=branch,suffix=-${{ env.OS_TAG}}
type=ref,event=tag,suffix=-${{ env.OS_TAG}}
type=ref,event=pr,suffix=-${{ env.OS_TAG}}
type=raw,value=latest-${{ env.OS_TAG}},enable={{is_default_branch}}
type=sha,suffix=-${{ env.OS_TAG}}
- name: Extract metadata (tags, labels) for GHCR
id: meta_ghcr
uses: docker/metadata-action@v5
with:
images: ${{ env.GHCR_REPO }}
tags: |
type=schedule,suffix=-${{ env.OS_TAG}}
type=ref,event=branch,suffix=-${{ env.OS_TAG}}
type=ref,event=tag,suffix=-${{ env.OS_TAG}}
type=ref,event=pr,suffix=-${{ env.OS_TAG}}
type=raw,value=latest-${{ env.OS_TAG}},enable={{is_default_branch}}
type=sha,suffix=-${{ env.OS_TAG}}
- name: Build Docker image
uses: docker/build-push-action@v6
env:
CACHE_SPEC: "type=registry,ref=${{ env.GHCR_REPO }}:${{ env.GIT_BRANCH }}-${{ env.OS_TAG}}-buildcache"
with:
context: .
file: ./docker/Dockerfile
build-args: |
CLANG_VER_OLD=${{ env.CLANG_VER_OLD }}
CLANG_VER_NEW=${{ env.CLANG_VER_NEW }}
BASE_IMAGE=${{ env.BASE_IMAGE }}
LIBG722_IMAGE=${{ env.LIBG722_IMAGE }}
CCACHE_IMAGE=${{ env.CCACHE_BIMAGE }}
CCACHE_BIN_IMAGE=${{ env.CCACHE_BIN_IMAGE }}
CCACHE_ROOT=${{ env.CCACHE_ROOT }}
LIBSSL_APKG=${{ env.LIBSSL_APKG }}
tags: ${{ env.BUILD_IMAGE }}
platforms: ${{ env.PLATFORMS }}
push: true
cache-from: ${{ env.CACHE_SPEC }}
cache-to: ${{ env.CACHE_SPEC }},mode=max
- name: Export ccache
if: ${{ env.DOCKER_RW }}
uses: docker/build-push-action@v6
with:
file: ./docker/Dockerfile.export_ccache
build-args: BUILD_IMAGE=${{ env.BUILD_IMAGE }}
tags: ${{ env.CCACHE_IMAGE }}
platforms: ${{ env.PLATFORMS }}
push: true
- name: Push Docker image
if: ${{ env.DOCKER_RW }}
uses: docker/build-push-action@v6
with:
context: .
file: ./docker/Dockerfile.push
build-args: |
BASE_IMAGE=${{ env.BASE_IMAGE }}
BUILD_IMAGE=${{ env.BUILD_IMAGE }}
push: true
tags: |
${{ steps.meta_dkr.outputs.tags }}
${{ steps.meta_ghcr.outputs.tags }}
labels: |
${{ steps.meta_dkr.outputs.labels }}
${{ steps.meta_ghcr.outputs.labels }}
platforms: ${{ env.PLATFORMS }}
- name: Update DockerHub repo description
if: ${{ env.DOCKER_RW }} && ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
env:
DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: sh -x docker/update_description.sh docker/README.md